From 73cad26cc16ca9c28515df1211f078bc6600b93d Mon Sep 17 00:00:00 2001
From: Dan Fiedler <danfiedler@microsoft.com>
Date: Wed, 7 Oct 2026 17:25:25 -0400
Subject: [PATCH] Pin GitHub Actions to full-length commit SHAs

---
 .github/dependabot.yml                  | 4 +++-
 .github/workflows/build.yml             | 8 ++++----
 .github/workflows/codeql.yml            | 6 +++---
 .github/workflows/copilot-review.yml    | 2 +-
 .github/workflows/dependency-review.yml | 4 ++--
 .github/workflows/semantic-index.yml    | 8 ++++----
 6 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a56aae0..63de873 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -21,4 +21,6 @@ updates:
     open-pull-requests-limit: 5
     labels:
       - dependencies
-      - ci/cd
\ No newline at end of file
+      - ci/cd
+    cooldown:
+      default-days: 7
\ No newline at end of file
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d1c787a..f8d54e5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,10 +16,10 @@ jobs:
       matrix:
         node-version: [20.x, 22.x]
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Setup Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ matrix.node-version }}
         cache: npm
@@ -41,10 +41,10 @@ jobs:
     if: github.ref == 'refs/heads/main'
     needs: build
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Setup Node.js
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 22.x
         cache: npm
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e305be8..7acf5b9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -57,7 +57,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -67,7 +67,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -96,6 +96,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/copilot-review.yml b/.github/workflows/copilot-review.yml
index d4ae2eb..d936480 100644
--- a/.github/workflows/copilot-review.yml
+++ b/.github/workflows/copilot-review.yml
@@ -12,7 +12,7 @@ jobs:
       contents: read
     steps: 
       - name: Request Copilot Review
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index ea422fd..7fe1949 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Dependency Review
-      uses: actions/dependency-review-action@v5
+      uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
       with:
         fail-on-severity: high
         deny-licenses: GPL-2.0, GPL-3.0, AGPL-3.0
diff --git a/.github/workflows/semantic-index.yml b/.github/workflows/semantic-index.yml
index c1365e3..e82eddf 100644
--- a/.github/workflows/semantic-index.yml
+++ b/.github/workflows/semantic-index.yml
@@ -43,9 +43,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60 # a full ~35k rebuild fits comfortably (~30 min budget)
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22.x
           cache: npm
@@ -63,7 +63,7 @@ jobs:
 
       # Cache the ONNX model weights between runs (miss -> downloaded from HF).
       - name: Cache embedding model
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.cache/semantic-model
           key: semantic-model-minilm-v1
@@ -88,7 +88,7 @@ jobs:
           echo "---- meta.json ----"; cat .semantic-index/meta.json
 
       - name: Upload index artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: semantic-index
           path: .semantic-index/